whichlib

io.github.josifb由 GitHub 账号 josifb 发布v0.2.4更新于 Oct 29, 2026

Dependency picker for coding agents: recommends, compares and scores GitHub repos with a verdict.

已验证Streamable HTTP可网页运行网页搜索与抓取开发者工具数据与分析

概览

AI 生成的概览

whichlib 是一个依赖选择 MCP 服务器,基于 GitHub、npm 和 PyPI 实时数据推荐、比较并评分开源库。

可以做什么
  • 用自然语言描述需求,获得按匹配度排序的库推荐,附评分、下载量和一句话结论
  • 并排比较 2-10 个已知仓库,给出评分、等级、星标、分支、议题、许可证、下载量和结论
  • 按日、周、月或本周涨星发现热门仓库,可按语言筛选
  • 为每个结果提供透明的 0-100 评分明细(势头、维护、采用度、许可证)和安装名称
适用场景
适合在编码助手准备新增依赖、用户询问该用哪个库,或不确定某个包是否存在、是否仍在维护时使用。也适合发现新项目,但不适合用来挑选依赖。
运行要求
可作为托管远程端点使用,无需 Node;也可通过 npx whichlib 本地运行,需要 Node 22 或更高版本。无需账号或 API 密钥。可选 GITHUB_TOKEN(托管端点用 X-GitHub-Token 请求头)可提高 GitHub 搜索限额;可选的 WHICHLIB_TELEMETRY 或 DO_NOT_TRACK 设置控制匿名调用统计。需要访问 GitHub、npm 和 PyPI 的网络。
安装前请注意
托管端点在不使用自己的 GitHub 令牌时每天限 50 次免费调用;本地服务器每次调用会发起多次 GitHub 搜索,没有 GITHUB_TOKEN 时可能触发速率限制。匿名调用统计默认开启(工具名、随机安装 ID、版本、平台、Node 主版本、协议版本,绝不含查询或结果),可用 WHICHLIB_TELEMETRY=off 或 DO_NOT_TRACK=1 关闭。默认会把每日星标数据下载到本地目录,除非设置 WHICHLIB_HISTORY=off。评分是启发式指标,不保证质量。

安装

在 SourceWeft 中

  1. 打开 控制台中的 whichlib,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable,通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体,或 SourceWeft 对话中。智能体会读取该服务器的安装指南,先向你展示发布者、端点和登录方式,经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.josifb%2Fwhichlib/install.md,并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前,先告诉我它的发布者、端点和登录方式,等我确认。不要把 API 密钥写进命令或我会提交的文件;问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "whichlib": {
      "type": "http",
      "url": "https://whichlib.com/mcp"
    }
  }
}

README

whichlib

The dependency picker for coding agents. Ask which library to use and get a scored, verified answer instead of a guess.

whichlib is an MCP server with three tools. It speaks MCP 2026-07-28; older clients keep working. Every repository it returns carries a transparent 0–100 score (momentum, maintenance, adoption including npm and PyPI downloads, license), a tier, a one-line verdict and the full breakdown, so the agent can justify the pick and you can read why.

For teams (waitlist): alerts when a dependency your repos use goes stale, and rules your team's coding agents must follow when they add one. Add a 👍 to the waitlist issue; at 20 signups it gets built. whichlib itself stays free.

Install

Claude Code:

claude mcp add whichlib -- npx -y whichlib

Cursor, Windsurf and other MCP clients:

json
{ "mcpServers": { "whichlib": { "command": "npx", "args": ["-y", "whichlib"] } } }

Requires Node 22 or newer. No account, no API key.

Use it without installing (hosted, no Node needed):

claude mcp add --transport http whichlib https://whichlib.com/mcp

Limits and the web API: https://whichlib.com/docs/

Tools

ToolAskYou get
recommend_reposneed in plain words, optional language, limit 1–10The best repositories for the need, ranked by fit (score × relevance), with downloads and a verdict each
compare_reposrepos: 2–10 names as owner/repoThe repositories side by side, best first, same breakdown
trending_reposperiod day / week / month / rising, optional language, limitMost-starred repositories created in the period, scored; rising: repositories of any age by stars gained this week

Example, in Claude Code: "which Python PDF parser should I use?" → MinerU, pdfplumber, pypdf with scores, weekly downloads and verdicts like "Rising fast, 26k downloads/wk, pushed 3 days ago, Apache-2.0".

Score

PartWeightSignal
Momentum40%Stars gained over 7 days (from daily star counts when available), else stars per day since creation, scaled by the npm/PyPI download trend when known (0.5–2x). Log scale.
Maintenance25%Days since last push, full marks to 30 days, zero at a year. Widely used repos (10k+ stars or 100k+ weekly downloads) never drop below half.
Adoption25%Stars, forks and npm / PyPI weekly downloads, log scale.
License10%Permissive 1.0, weak copyleft 0.75, strong copyleft 0.5, none 0.

Tiers: Strong ≥ 75, Solid ≥ 50, Watch ≥ 25, Avoid; repos younger than 30 days are New ("Too new to judge"), whatever their score. Archived repos are capped at 20. On a 20-need eval the top recommendation is an accepted answer 75% of the time and the top five contain one 100% of the time; the eval and its reports live in the repository.

Environment variables, all optional

  • GITHUB_TOKEN: raises GitHub's search limit from 10 to 30 per minute. A fine-grained token with no permissions is enough. Recommend makes three searches per call.
  • WHICHLIB_HISTORY=off: do not download daily star counts. By default the server keeps the last 10 days in ~/.whichlib/stars/, refreshed in the background at most every 12 hours from raw.githubusercontent.com, so momentum uses real stars gained per week for the top 1,000 repos per language and new trending repos. Nothing is sent with that download.
  • FRESH_REPOS_DATA_DIR: a folder of daily snapshots or star counts to use instead (see the repository's data branch).
  • WHICHLIB_TELEMETRY=off or DO_NOT_TRACK=1: disables anonymous call counting. What is counted: tool name, a random install id, version, platform, Node major version, the MCP protocol version of the call. Never queries, repository names or results. The aggregate numbers are public at https://whichlib-telemetry.todorovskijosif.workers.dev/stats.

Source, dashboard, data

Repository: https://github.com/josifb/whichlib (MIT). It also holds the Fresh Repos dashboard (most-starred new repositories, day / week / month, sortable, one HTML file), the nightly snapshot and enrichment jobs, the recommendation eval, and 80+ unit tests.

Development, from the whichlib/ folder of the repository:

npm test           # unit tests, no networknpm run mcp:smoke  # start the server over stdio and call every tool livenpm run eval       # 20-need recommendation eval (set GITHUB_TOKEN)npm run snapshot   # today's top repos per period and language -> data/snapshots/npm run enrich     # add npm / PyPI packages and weekly downloads to the latest snapshotnpm run score      # top repos from the latest snapshot with score and verdictnpm run pull-data  # copy snapshots from the data branch

Layout:

mcp/server.mjs         MCP entry (stdio)        mcp/tools.mjs       tool logicmcp/expand.mjs         query expansion          mcp/telemetry.mjs   anonymous call countingmcp/github-api.mjs     GitHub client + cache    mcp/data.mjs        snapshot history providermcp/eval/              needs, metrics, runner, inspect, results/lib/score.js           the score, shared by browser and Nodesnapshot/src/          query, normalize, github, registry, enrich, history, run, score-report, pull-datadashboard/index.html   redirect to whichlib.com/repos (Fresh Repos)

来源:whichlib/README.md,提交 a4d1c68

工具

3

recommend_repos

Recommend repositories

Find the best open-source library for a need before adding a dependency. Give the need in plain words and get up to `limit` GitHub repositories ranked by fit = score x relevance to the need. Each result has a 0-100 score (momentum 40% (stars gained per week; without history, lifetime stars per week scaled by the npm/PyPI download trend), maintenance 25%, adoption incl. npm/PyPI weekly downloads 25%, license 10%), a tier (Strong >=75, Solid >=50, Watch >=25, Avoid <25; New for repos under 30 days old, too new to judge), a one-line verdict and the full breakdown. Use this when you do not yet have candidates; use compare_repos when you already have names. Makes 3 GitHub searches plus npm/PyPI lookups for the shortlist. Hosted: 50 free tool calls per day per user; send header X-GitHub-Token with your own GitHub token for unlimited use, or run the npm package locally (npx -y whichlib).

输入参数need必填limitlanguage

compare_repos

Compare repositories

Compare 2-10 known GitHub repositories side by side, best score first: score and tier, stars, forks, open issues, last push, license, npm/PyPI weekly downloads (only when the registry links back to the repository) and a verdict. Each result has a 0-100 score (momentum 40% (stars gained per week; without history, lifetime stars per week scaled by the npm/PyPI download trend), maintenance 25%, adoption incl. npm/PyPI weekly downloads 25%, license 10%), a tier (Strong >=75, Solid >=50, Watch >=25, Avoid <25; New for repos under 30 days old, too new to judge), a one-line verdict and the full breakdown. Use this to choose between candidates you already have (for example zod vs valibot) or to check a dependency the project already uses; use recommend_repos to find candidates. One GitHub API call per repository plus npm/PyPI lookups. A repository that does not exist is listed under notFound and the rest are still compared; the call fails only if none can be fetched, or when GitHub's rate limit is reached or the token is rejected. Hosted: 50 free tool calls per day per user; send header X-GitHub-Token with your own GitHub token for unlimited use, or run the npm package locally (npx -y whichlib).

输入参数repos必填

版本历史

10
  1. v0.2.4最新Oct 29, 2026
  2. v0.2.3Oct 15, 2026
  3. v0.2.2Oct 15, 2026
  4. v0.2.1Oct 14, 2026
  5. v0.2.0Oct 7, 2026
  6. v0.1.5Oct 3, 2026
  7. v0.1.4Oct 2, 2026
  8. v0.1.2Sep 29, 2026
  9. v0.1.1Sep 28, 2026
  10. v0.1.0Sep 27, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分